Hi.

I have a problem with ldapgroups module. Both ldapauth and ldapdata works fine for me, but I can't manage to make ldapgroups work! I'm using the third mode to import groups in Drupal ("Groups exist as LDAP entries where a multivalued attribute contains the members' CNs") because this is the way groups are stored in my LDAP server. I set the starting node and the attribute, but, when I login as a LDAP user (that belongs to a group) nothing happens. I also try to comment ldapgroups_roles_filter function in ldapgroups.conf.php, but nothing changed. Any suggestions?

Thanks in advance.

Tiziano

Comments

pixel13’s picture

Title: Can't import groups! » LDAP user permissions and groups

I found the problem by myself. In _ldapgroups_detect_groups function there's the following code:

  $dn = isset($_SESSION['ldap_login']['dn']) ? $_SESSION['ldap_login']['dn'] : '';
  $pass = isset($_SESSION['ldap_login']['pass']) ? $_SESSION['ldap_login']['pass'] : '';

  if (!$ldap->connect($dn, $pass)) {
    $row2 = db_fetch_object(db_query("SELECT binddn, bindpw FROM {ldapauth} WHERE name = '%s'", $ldap->getOption('name')));
    $dn = $row2->binddn;
    $pass = $row2->bindpw;

    if (!$ldap->connect($dn,$pass)) {
      watchdog('user', "User login: user $user->name's data could not be read in the LDAP directory", WATCHDOG_WARNING);
      return false;
    }      
  }

Well, in $_SESSION['ldap_login'] are stored the LDAP data of current user. So, the ldapgroups module, fist try to access LDAP server with current user, then try with the user stored in the DB. Well, in the LDAP server I'm using, a common user cannot make queries, but obviously he/she can authenticate to the server. So, the first $ldap->connect return TRUE (because the common user can connect to the server), but when ldapgroups try to search in LDAP directory, he cannot read a thing, because the user have got no permissions. If I change the first:

  if (!$ldap->connect($dn, $pass)) {

with:

  if (TRUE) {

everything works fine.
Is there a way to forbid the connection with current user's credential and use directly those in the DB without hacking the code?

Thank you.

Tiziano

johnbarclay’s picture

Status: Active » Closed (won't fix)

Closing 5.x issues to clean out issue queue.